I've tried posting this xml:


to these addresses:

404 - "Not Found"
404 - "Not Found"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
404 - "Not Found"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
500 - "Server Error"
404 - "Not Found"
404 - "Not Found"

I've tried with and without the GeoFence plugin.

Is this actually possible?

I have succeeded in creating roles, usergroups, workspaces, coverageStores and raster layers from GeoTiff files, and dataStores and vector layers from shapefiles, but no progress on creating users.

I gather that some modules require you to change the admin password from the default, so I've done that too. My admin account has ADMIN, GROUP_ADMIN, and ROLE_ADMIN roles, and I've even added a USER_ADMIN role in the case such a thing exists.

I'm running geoserver-2.12-SNAPSHOT from 18 September.


I have found temporary solution for this.

The reason of this is that the XStream cannot map XML/JSON to org.geoserver.rest.security.xml.JaxbUser because there is no alias "user" for this.

There are two solutions for it.

  1. Use full class name with package in your XML/JSON.

Something like this:


  "userName": "test",
  "password": "test",
  "enabled": true

If you use XML there is propably the same way.

  1. Edit org.geoserver.rest.security.UsersRestController class.

Add super class org.geoserver.rest.RestBaseController to it and override two methods

    public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return JaxbUser.class.isAssignableFrom(methodParameter.getParameterType());

    public void configurePersister(XStreamPersister persister, XStreamMessageConverter converter) {

            persister.getXStream().alias("user", JaxbUser.class);

After one of those solutions you need to add JaxbUser.class to XStream whitelist. The simplest way to do it is adding system/environment/context variable GEOSERVER_XSTREAM_WHITELIST like GEOSERVER_DATA_DIR. E.g -DGEOSERVER_XSTREAM_WHITELIST=org.geoserver.rest.security.xml.JaxbUser

I hope this will be fixed in next versions of Geoserver. By the way the GeoServer Documentation is full of lack and need to be polished.

I have posted the same on Jira.


You are very close. The documentation shows that you need to POST to


As long as you are executing the POST as a user with the role ROLE_ADMIN it should work as expected.

  • 1
    http://localhost:8080/geoserver/rest/usergroup/service/users/ 404 - "Not Found" http://localhost:8080/geoserver/rest/security/usergroup/service/users/ 404 - "Not Found" I'm afraid the documentation has shown lots of examples that are incorrect. Sorry - I can't get sensible formatting in this comment. – Joe Hotchkiss Sep 28 '17 at 12:57
  • 1
    The documentation shows the url as /rest/usergroup/[service/<serviceName>/]users/ so if I include the "service" element in the path then that needs to be followed by a service name e.g. "default" or "MyGroup". I should be able to list users at this url but actually I need to include the "security" element in the path to get it to work. – Joe Hotchkiss Sep 28 '17 at 13:05
  • please submit a PR for the docs if you find an issue – Ian Turton Sep 29 '17 at 10:27
  • 1
    Any news on this? I'm experiencing the same issue with the 2.12.0 version of GeoServer. The docs seems to be wrong, one has to add the /security/ to the url to access the usergroup rest api as mentioned above. The POST to the same url does not work, I get a 500 error. Besides the docs says that I should be able to perform all requests with content-type and accept header application/json but this gives a 406 Not acceptable error. – antonLundkvist Oct 18 '17 at 20:40
  • 2
    I am getting similar results, bot xml and json posts are reporting 500 errors for me on GeoServer 2.12.1. Checking the logs I get: Testing /rest/security/usergroup/users/ for monitor filtering ERROR [geoserver.rest] - user com.thoughtworks.xstream.mapper.CannotResolveClassException – Bwyss Dec 12 '17 at 0:31

For anyone who's still getting problems with this, it's been fixed in v2.15.1. I've updated it and it all works no problems now, although I'm using the rest/security/usergroup/users/ route as I get a 404 if I try rest/usergroups/users


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.